Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component.

The camel-mongodb-gridfs producer selects t…

CVE-2026-48204 is a high-severity vulnerability in Apache Camel's camel-mongodb-gridfs component involving Improper Input Validation and Improper Access Control. The flaw arises because GridFS control header constants (e.g., gridfs.operation, gridfs.objectid) do not use the 'Camel/' prefix, allowing them to bypass the HttpHeaderFilterStrategy filter at the HTTP boundary. An unauthenticated attacker can inject these headers into an inbound HTTP request to override the route's intended GridFS operation, enabling unauthorized file deletion, enumeration, or reading. Additionally, attacker-supplied gridfs.metadata values are parsed as MongoDB documents, enabling NoSQL operator injection attacks. The vulnerability affects Apache Camel versions 4.0.0 through 4.21.0 across multiple release streams. Fixes are available in versions 4.21.0, 4.18.3, and 4.14.8. Mitigations include setting explicit operations on the mongodb-gridfs endpoint and stripping gridfs.* headers from untrusted ingress traffic.